[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwHLjAxdm6VjuDnAIHGZnaB1MCwbVOPYS9s5RqFcmd-k":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"330de00e-d7d6-4d0e-9b83-85132c5a9075","Garante per la protezione dei dati personali (Italy) - 10254256","garante-per-la-protezione-dei-dati-personali-italy-10254256-d0b658","Created page with \"{{DPAdecisionBOX |Jurisdiction=Italy |DPA-BG-Color=background-color:#095d7e; |DPAlogo=LogoIT.png |DPA_Abbrevation=Garante per la protezione dei dati personali |DPA_With_Country=Garante per la protezione dei dati personali (Italy) |Case_Number_Name=10254256 |ECLI= |Original_Source_Name_1=Garante per la protezione dei dati personali |Original_Source_Link_1=https:\u002F\u002Fwww.garanteprivacy.it\u002Fweb\u002Fguest\u002Fhome\u002Fdocweb\u002F-\u002Fdocweb-display\u002Fdocweb\u002F10254256 |Original_Source_Language_1=It...\" Show changes","Italy's Garante per la protezione dei dati personali has fined the Ministry of Justice €12,000 for unlawfully disclosing an employee's health data. The data subject's service order, which included references to their physical conditions and need for posture alternation, was posted on a canteen bulletin board accessible to all staff. The DPA ruled this constituted a violation of GDPR, classifying the information as health data.","Italy's DPA fines Ministry of Justice €12,000 for posting employee's medical details publicly.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_10254256&diff=52411&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-07-20T11:51:46+00:00","2026-07-20T12:00:16.843989+00:00",7,[17],{"name":18,"type":19},"Ministry of Justice","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":20,"icon":22,"name":23,"slug":24},null,"Policy","policy",[26,31,36],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":32},{"id":33,"icon":22,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":22,"name":39,"slug":40},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":44,"vendors":45},[],[],{"slug":47,"title":48,"body":49,"framework_refs":50,"framework_notes":62},"italian-ministry-of-justice-fined-for-posting-employee-health-data-on-canteen-bulletin-board","Italian Ministry of Justice Fined for Posting Employee Health Data on Canteen Bulletin Board","The Italian Ministry of Justice violated GDPR by posting a service order containing an employee's health-related information — specifically references to physical conditions and the need for posture alternation — on a canteen bulletin board visible to all staff. Health data is classified as a 'special category' of personal data under GDPR Article 9, requiring a much higher standard of protection and a lawful basis for processing. The root failure was a lack of staff awareness and internal procedures governing how sensitive personal data should be communicated and displayed. This case illustrates that data breaches do not require digital systems — physical handling of personal data carries the same legal obligations and risks. Even a low-tech disclosure can result in regulatory fines, reputational damage, and harm to the affected individual.",[51,52,53,54,55,56,57,58,59,60,61],"GDPR Article 9 — Processing of special categories of personal data","GDPR Article 5(1)(f) — Integrity and confidentiality principle","GDPR Article 32 — Security of processing","GDPR Article 33 — Notification of a personal data breach to the supervisory authority","NIST SP 800-53 AC-3 — Access Enforcement","NIST SP 800-53 AT-2 — Literacy Training and Awareness","NIST SP 800-53 MP-3 — Media Marking","CIS Control 3 — Data Protection","CIS Control 14 — Security Awareness and Skills Training","ISO\u002FIEC 27001:2022 Annex A 5.12 — Classification of information","ISO\u002FIEC 27001:2022 Annex A 6.3 — Information security awareness, education and training",{}]